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Abstract 



We provide the currently fastest randomized (1 + e) -approximation algorithm for the closest vector 
problem in the ^oo-norm. The running time of our method depends on the dimension n and the 
approximation guarantee e by 2'^'"'(logl/£:)'^'"^ which improves upon the (2 + running 
time of the previously best algorithm by Blomer and Naewe. 

Our algorithm is based on a solution of the follov^ring geometric covering problem that is of 
interest of its own: Given e e (0, 1), how many ellipsoids are necessary to cover the cube [- 1 + e, 1 - 
£]" such that all ellipsoids are contained in the standard unit cube [-1,1]"? We provide an almost 
optimal bound for the case where the ellipsoids are restricted to be axis-parallel. 

We then apply our covering scheme to a variation of this covering problem where one wants 
to cover [- 1 -i- £, 1 - e] " with parallelepipeds that, if scaled by two, are still contained in the unit 
cube. Thereby, we obtain a method to boost any 2-approximation algorithm for closest-vector in 
the ^oo-norm to a (1 -i- e)- approximation algorithm that has the desired running time. 
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1 Introduction 



The closest lattice vector problem (CVP) is one of the central computational problems in the geometry 
of numbers. Here, one is given a rational lattice A{A) = {Ax: x e Z"}, A e Q""^" and a target vector 
t e Q". The task is to compute a lattice-point in A(^) that is closest to t w.r.t. a given norm. In this 
paper, we focus on the closest vector problem in the ^oo-norm. CVP in the ^oo-norm is an integer 
programming problem: Given a rational polytope PqU", compute an integer point inside P or assert 
that P does not contain any integer points. On the other hand, any integer programming problem as 
above can be directly reduced to CVPoo in a lattice in m-dimensional space, where m is the number 
of inequalities describing the polytope. Integer programming is one of the most versatile modeling 
paradigms with a wide range of applications. Thus the closest vector problem in the foo-norm variant 
is particularly important. 

The development of methods to solve closest-vector and integer programming problems resulted 
in many deep discoveries in geometry and algorithms. Lenstra ILen83l showed that integer pro- 
gramming and thus CVPoo can be solved in polynomial time if the dimension is fixed. His algo- 
rithm lay the first planks between the geometry of numbers and optimization. For varying n, the 
running time of his method is 2'-"-" ' times a polynomial in the binary encoding length of the input. 
Kannan |Kan87| presented algorithms for these problems whose running- time dependence on n is 
bounded by 2°'"^°8"' . An important step forward in the quest for a singly-exponential time algorithm 
was provided by Ajtai et al. | AKSOiJ . They presented a 2*^'"' randomized algorithm for the shortest vec- 
tor problem in the ^2-norm: Given a lattice, find the shortest nonzero lattice vector. These results have 
been generalized for any ^p-norm by Blomer and Naewe IBN09I . Micciancio and Voulgaris IMVIO] 
provided a deterministic singly-exponential time algorithm both for the shortest vector problem as 
well as for the closest vector problem in the ^2 -norm. Recently Dadush et al. IDPVIOI have shown that 
the shortest vector problem w.r.t. any norm can be solved with a deterministic singly-exponential 
time algorithm. 

Approximation algorithms 

A (1 + e)- approximation algorithm for the closest vector problem computes a lattice vector whose 
distance to the target vector t is at most (1 -t- e) times the minimum distance min{|| v- t\\: v e AiA)}. 
The closest vector problem is NP-hard for any £p norm lvEB81l and NP-hard to approximate within 
constant factors IAro94l and even almost polynomial factors IDKRS03I . So clearly one cannot expect 
to have a polynomial-time approximation scheme (PTAS) for closest vector. An interesting problem 
is however to design exponential-time approximation algorithms whose running-time dependence 
on the approximation guarantee is not too large. Ajtai et al. IAKS02I provided a (1 -1- £) -approximation 
algorithm for CVP2 with a running time of 2'-"-^'''^'^^". Blomer and Naewe IBN09I could improve on 
this and provide a randomized (1 + e) -approximation algorithm for the closest vector problem w.r.t. 
any dp norm that has a running time of (2 + 1 /e) . 

Our main result is a randomized (1 + e) -approximation algorithm for CVPoo whose running time de- 
pends on n and e by 2'^'"'(logl/£)'^'"'. In fact, we show that any singly-exponential time constant 
factor approximation algorithm can be strengthened to a (1 + e) -approximation algorithm that, in the 
end, has this running time. Using the randomized algorithm of Blomer and Naewe IBN09I to obtain 
2-approximate solutions, we obtain the desired running time. 

^To decide if a polytope P = {x e K" : Ax < u}, contains an integer point, compute a vector I < u such that P = {xe 
R" : / < Ax < Ml. By rescaling each row we can wlog assume that m - Z = 1. Now define t := and observe that P contains 
an integer point iff there is a £ A(^) with || — til 00 — 2' This lattice is not necessarily of full rank, but the technicjues of 
this paper - whose running time, like those of previous algorithms, depends on the ambient dimension - can be applied. 
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The covering technique 

We now explain how coverings of tlie cube by convex bodies come into play to obtain the complexity 
result. Suppose that we have an algorithm for closest vector in the ^2 -norm and we want to apply this 
to (approximately) decide whether the translated ^00-unit ball B = [x eU": || x - f ||oo ^ 1} contains a 
lattice point in A(A). More precisely, given an e > 0, we either want 

i) to find a lattice point in B, 

ii) or to assert that the scaled unit ball B' = {x eU" : ||x- f ||oo ^ l-f} does not contain a lattice point. 

One obvious idea is to determine a set of balls of radius e whose centers lie in B' and whose union 
covers B'. If we then use the closest-vector algorithm for the ^2-norm and target-vectors being the 
centers of the balls, we can solve the above problem. If one of the calls to a closest vector oracle 
returns a lattice point of distance at most e, then we are in caseE). Otherwise we are in caseEB. 

This relates to a classical covering problem. Erdos and Rogers IER62I (see also IFK08I 1 showed 
that the space IR" can be covered by translates of unit spheres in such a way that no point is covered 
by more than O(nlogn) spheres. We can use this to cover [-1 + £,!-£]" with spheres of radius e 
that then will be contained in [-1, 1] The Erdos and Rogers technique would yield an upper bound 
of 0(nlogn)^j^y|y- where V„ is the volume of the ^2-unit ball. This yields the bound (n/e)'^'"' for 
the number of queries to the CVP2 -oracle. Certainly, since the ratio of the volume of the unit cube 
[-1, 1] to the volume of the f2-unit ball {xeU": \\x\\2 < 1} is 2*^'"^°^"', we cannot hope to improve the 
dependency on the dimension. But can we improve the dependence on e? 

Since an ellipsoid is the image of the ^2 -unit-ball {xeU": || x||2 < 1} under an afflne transforma- 
tion fix) = Ex + dfoT some non-singular matrix E e IR"'' " and a vector deU", the problem whether 
such an ellipsoid contains a lattice vector is the closest vector problem w.r.t. the ^2 -norm in the lat- 
tice A[E~^A) and target vector E~^d. Thus, we can apply the algorithm for CVP2 to decide whether 
an ellipsoid contains a lattice point or not. This gives us more flexibility for the reduction of approxi- 
mate CVPoo to CVP2. Consequently, if we cover B' with ellipsoids that are contained in B we can solve 
the approximate decision problem via calls to a CVP2 -oracle. This motivates the following covering 
problem. 

How many ellipsoids that are contained in [- 1, 1] " are needed to cover [- 1 + f, 1 - f] "? 

As we mentioned above, the volume of the cube versus the volume of an inscribed ball shows that 
covering with ellipsoids cannot yield a singly-exponential dependence of the running time on the 
dimension n. However, a similar idea and technique is the basis of our promised complexity result. 
The image of the unit-cube [-1,1]" under and affine transformation /(x) = Ex+d is a parallelepiped. 

With a 2-approximation algorithm for CVPqo one can, for a given parallelepiped P find a lattice 
point in Pg, where Pg stems from P via scaling by 2 from its center of gravity d, or assert that P does 
not contain a lattice point. More precisely this can be done by a call to a 2-approximation algorithm 
on the lattice A(_E~^A) and target-vector E~^d. This motivates the following variant of the above 
described covering problem. 

How many parallelepipeds that, if scaled by 2 from their centers of gravity are contained 
in the unit cube [-1, 1]", are necessary to cover the cube [-1 + e, 1 - e]"? 

We consider the two covering problems from above and provide the following results. 

• We show that the number of required ellipsoids is bounded by 2°f"^°S") (i + log 1/e)" and pro- 
vide a c„(l + Llogl/eJ)""^ lower bound for axis-parallel ellipsoids. 
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• We show that the number of required parallelepipeds is bounded from above by 2" (1 + log 1 /e) " 
and from below by cj,{l + [logl/ej)". 

The second result yields a Z^'^'Clogl/e)*^'"' randomized algorithm that solves the approximate deci- 
sion version of closest vector in the ^oo-norm. The lower bound shows that this complexity is optimal 
for an algorithm relying on this covering technique alone. Our main result, the 2°'"' (log 1 Ie) time 
(1 + e)- approximation algorithm, is then obtained via a binary-search technique. We explain this in 
the final section of our paper. 



2 The covering problems 

We now consider the two covering problems from the introduction. We denote the cube [-1, 1]" by H 
audits scaled version [-!+£,!-£]" by //g. The questions are again as follows. Given an e e (0, 1), what 
is the smallest number E[n,e) of ellipsoids contained in H such that their union covers the smaller 
cube //f? What is the smallest number P{n,£) of parallelepipeds that are contained in H after being 
scaled by 2 and whose union covers //f? 



2. 1 Covering with ellipsoids 

We first show that Ein,e) is bounded by 2'^"'°^"{1 -i-logl/e)". Since we can allow us a factor of 2", we 
cover each intersection of with an orthant separately and then combine the different coverings, 
see also the figure on the title-page. After flipping coordinates and after translation, the problem for 
one orthant can be interpreted as follows. How many ellipsoids that are contained in H' := [0, 2] " are 
needed to cover the cube [e, 1] "? 

The following elementary lemma (see also Figure[TJ is used in our construction. 

Lemma 2.1. Letn>2, r = l + 2/(v/n-l) and Q := [l/r,l]", then the smallest ball containing Q is 
contained in H' . Furthermore, r is maximal with this property. 

Proof. The center of Q and Bisd\ with 

•/n-l 



1+1 1 + 

d = 



r s/n+l 



2 -y/n + l 

Thus the radius of B is simply the distance of • 1 to the vertices of Q 



R = '/n{\-d) = s/n- 



v/n+lj \/n + l 



= d. 



Thus the ball is contained in the positive orthant. Furthermore, d + R<2, which shows the first claim, 
i.e. that B Q H' . The choice of r is maximal because the ball touches the coordinate hyperplanes. □ 

Corollary 2.2. Letn>2, r = \ + 21 {s/n- 1), v e (0,1]" andletQ:= [vir~^,Vi]x ...x [v„r~^, Vn\- Then 
there exists an axis-parallel ellipsoid E such thatQQEQ H' . 

This corollary is obtained from Lemma l27T] by scaling. We are now ready to prove the upper bound. 

Theorem 2.3. One has E{n, e) < 2'^"^°S" • [l + log 1 /f) " for a fixed constant c> 0. 
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Figure 1: Illustration of Lemma l2.1l 



Proof. We provide a covering of [e, I]" by ellipsoids contained in H' = [0,2]". Let r = 1 + 2/{\/li- I) as 
in Corollary l2.2l The smallest ellipsoid containing a box of the form 



Qia) 



r-(«i + l)^ ^-an ^, 



a e I 



is contained in H'. How many of these boxes are needed to cover the cube [e, 1] "? 

It is enough to consider those boxes Q(a) wdth r~"j > e for all j. Taking logarithms, one obtains 
aj log r < log 1 /£. A standard approximation for the logarithm yields log r > c' I \fn for some constant 
d > 0, and so we can conclude aj < \/nlog(l Ie)Ic' . In total, we require at most 



1 + ^.logl/d 













[ c J 



(1 +l0gl/£)" < 2'^"'''S"(l +logl/£) 



boxes to cover [£, 1]". Since by Corollary l2.2l each of these boxes can be covered by an ellipsoid con- 
tained in H' , this completes the proof. □ 



2.1.1 A lower bound for axis parallel ellipsoids 

Can the dependence on n be improved? Note that the volume of is (2 - 2£')", whereas the largest 
ellipsoid contained in H is the n-dimensional euclidean ball with radius 1 centered in which is of 
volume 2"^'"^''8"'. So for fixed e e (0, j), simply by accounting for volume it is clear that we need at 
least 2"("i''g"' ellipsoids. 

What about the dependence on £? This seems to be a more difficult question. We can prove the 
following. 

Theorem 2.4. Fix the dimension n > 2. There exists a constant c„ > 0, depending only on n, such 
that for all e e (0, 1), any covering of He by axis parallel ellipsoids contained in H consists of at least 
c„ • [ 1 + [log 1 / ej ) " ^ ellipsoids. 

Proof. To simplify the argument, we again transform the problem so that we can work entirely within 
the positive orthant. Consider the grid 

Gj: := e IR" I Vj = 2~"' > e with aj e No for all l<j<n} 

Every covering of He using m axis parallel ellipsoids contained in H corresponds, by an affine trans- 
formation, to a covering of Ge using axis parallel ellipsoids £"1,. . . ,Em [R>q. Because we can grow the 
ellipsoids until they touch all coordinate hyperplanes, we can assume without loss of generality that 





'2~i''i-Xj] 








■•'1 




[ 2-^-v J 
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where the center off / is at {2~^'\...,2~^^'"). 

We will proceed to give an upper bound on the number \Ei tlGe] of grid points contained in an 
ellipsoid. Let v = {2-"0"^i e n G^. 



7 = 1 



7 = 1 



At most one summand - say the A;-th - can be greater than one half. We then must have {i -2^'>""j )^ < 
J for all i ^ k. K rough calculation shows -2 < - aj < 1, so there are at most 3 possible choices 
of aj e No for every j k. On the other hand, can take any integer value between and [log^J . 
Finally, there are n choices for k, giving the upper bound of 

|£;nG,|<n3"-i(l+[logl/£j). 

Combining this with the total number of grid points, we get 

m 

(l+[logl/£j)" = |G,|<^|£;nG,|<mn3"-i[l+[logl/£j). 

i=l 

The statement of the theorem follows, with c„ = (_n3"~^)~^. □ 

Note that this proof only works for axis parallel ellipsoids. It seems implausible that allowing 
arbitrary ellipsoids could yield significantly more efficient coverings. 



2.2 Covering with parallelepipeds 

The goal is to cover = [-1 + £, 1 - £]" by parallelepipeds that, if scaled by 2, are contained in H = 
[-1, 1]". The smallest number of such parallelepipeds is P{n,£). We again provide an axis-parallel 
covering. This time, however, we derive a lower bound that is asymptotically tight in the exponent, 
even for non-axis-parallel parallelepipeds. We remark that the results of this sections hold with only 
minor numerical changes for any constant scaling factor. We fix the factor 2 for concreteness and to 
simplify the presentation. First, we need an elementary lemma whose proof is straightforward. See 
Figure|2]for an illustration. 

Lemma 2.5. Let v e (0, 1]" and U = [1 - fi, 1 - ^1/3] x .. . x [l - v„,l - v„/3]. IfU is scaled by a factor of 
2 from its center of gravity, then it is still contained in [-1,1]". 

Theorem 2.6. OnehasPin,e) < 2" [I + logl/e)". 

Proof. We proceed by covering [0, 1 - £]" by boxes that, if scaled by two, are contained in [-1, 1]". 
Consider a box of the form 

U{a) = [l-3""i,l-3""i"^] X...X [l-3""M-3""""^], aeNj. 

By Lemma l23] these boxes are still contained in H after they are scaled by 2. How many of these boxes 
are needed to cover [0, l-£]"? We only have to consider Uia) with3~"j > £ for all j. Taking logarithms, 
this implies aj < ^^^g^- Thus we need at most (l + logl/£)" boxes. Repeating the procedure for each 
orthant yields the desired bound. □ 
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Figure 2: Left: An illustration of Lemma 12. 51 for Vy = ■■■ = v„ = I. Right: Covering one orthant with 
boxes of type U[a). 



2.2.1 A lower bound 

The approach described in the previous section can be thought of, in a more general form, as the 
problem of covering the cube using affine copies of a fixed centrally symmetric convex body K, 
such that constant multiples of the copies are still contained in H. We will show that the number of 
parallelepipeds is optimal as far as the growth of the exponents are concerned.The proof is analogous 
to that of TheoremEll 

Theorem 2.7. Let K c^W^ bea centrally symmetric body. Let K^,..., Km be affine copies ofK and let Kj 
be the result of scaling Kj by a factor of 2 around its center point Suppose thatK'- e H for all j, and 
Ki,..., Km together cover . Then > C(j [l + [log ) I where > only depends on n. 

Proof. By translating the given bodies, we can instead consider a situation where [£, 1] " is covered by 
Ki,..., Km and K'. c IR"^ for all j. In particular, this means that the grid 

:= {y e IR" I Vj = 2""' > e with aj e Nq for all l<j<n} 

is covered. Let us now determine the number of grid points contained in each Kj. Let aj be the center 
point of Kj. We have 

Kj Q{xeU" \ -aj <x< -aj}, 
^ 2 2 

where the first set of inequalities follows from the fact that K'j c IR!^^, and the second set of inequalities 
follows from central symmetry of Kj. There are at most two choices for at e Nq such that Xj = 2~"' 
satisfies the corresponding lower and upper bound. Consequently, Kj contains at most 2" grid points. 
Recall that the total number of grid points is (1+ Uogl/eJ)", from which the statement ofthe theorem 
follows. □ 



3 The approximation algoritlim 

We now present our (1 + e) -approximation algorithm for the closest vector problem in the £oo norm. 
We describe a boosting technique that turns any constant factor approximation algorithm for CVPqo 
into a (1 +£) -approximation algorithm at the expense of an additional factor of 2°'"' [log 1 /e) fo*^'!' 
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in the running time, where b denotes the encoding length of the input. It is a Karp reduction ap- 
proach, i.e. the constant factor approximation algorithm is used as an oracle and called multiple 
times on different inputs. 

We first consider the a-gap CVPoo problem, which is defined as follows. Given a lattice A{A), 
a target vector t and a number D > 0, either find a lattice vector v e A(^) with || v- t\\^ < D, or 
assert that all lattice vectors have distance more than a~^D. We show how to construct a (1 + e)- 
gap algorithm for CVPoo from a 2-gap algorithm using the covering with parallelepipeds described in 
SectionO 

Afterwards we describe a binary search procedure to obtain a (1 + e) -approximation algorithm, 
using the (1 + £)-gap algorithm as an oracle in each iteration of the binary search. 

We plug the currently fastest known constant approximation solver, the Blomer and Naewe (BN) 
algorithm | BN09 1 , into our construction and boost its success probability so that we obtain the fol- 
lowing approximation algorithm. 

Theorem 3.1. For every e e (0, 1), there is a randomized algorithm that [I + e) -approximates CVPoo in 
rime 2°'"' (log l/e)°'"' with success probability 1 - 2""'"' . 

The randomness is due to the fact that the BN algorithm is randomized. Our construction is 
deterministic. 

3. 1 Boosting gap solvers 

We now describe the (1 + e)-gap algorithm for CVPoo with the following properties. 

Theorem3.2. Givenanoraclethatsolves2-gapCVPcx> for every e e (0,1] we can solve [l+e] -gap CVPco 
using at most 2" • [2 + log " oracle calls. 

The encoding size of instances for each oracle query are polynomial in n, the original encoding 
length and in log 

In fact, any constant-gap oracle could be used. We choose to fix the approximation factor to 2 for 
concreteness and to simplify the presentation. 

Let [B, t, D) be the input. To solve the (l-i-e) -gap problem, we either need to find a vector v e A(5) 
with II V - f lloo ^ D, or assert that the box 

T:= t + D-l-l + 5,l-6r 

with 1-5=1/(1-1- e) does not contain a lattice point. By scaling the instance, we can assume without 
loss of generality that D = 1. Hence the box T is a translate of the box Hs= [ - 1 -i- 5, 1 - 5] " . As discussed 
in Section lZ2] there is a covering of Hg and therefore T with singly exponential many parallelepipeds. 
These parallelepipeds have the property that if they are scaled by a factor of 2 around their center 
of gravity, then they are still contained within f -t- [-1, 1]". This is useful because with one call to a 
2-approximation oracle for 2-gap CVPoo. we can either find a lattice vector with distance at most 1 
or assert that one of the parallelepipeds does not contain a lattice vector, as we show in the following 
lemma. 

Lemma3.3. Given a lattice JV{ A) and a parallelepiped P := [xeW^ : \\E{x- d)\\^<\}, a single call to 
a2-gap oracle for CVPoo either asserts that P n A(A) = or find a lattice vector v e A(A) contained in 
P^:={xelR" : \\E[x- d)\\oo ^2}, i.e. P scaled by 2 around its center of gravity d. 

Proof Define B:=E-A and t:=E-d and observe that P n A(5) ^ [P^ r\A[B) ^ 0) if and only if there 
is a vector ve A(_B) with distance at most 1 (2) from t. □ 
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Proof of Theorem\32\ Let [B, t, D) be the input. By scaling thie instance, we can assume without loss 
of generality that D = 1. Let 5 = j^, so that 1-5 = y^. Our goal is to either assert that the box 
T = t+l-l + 5,l-5]" is empty or to find a lattice vector in f + [-1, 1]". 

Let Pi,...,P]c with k<2" ■ [2 + log(i))" be parallelepipeds as in Theorem l2.6l Moreover for each i 
let P^ be the parallelepiped Pj scaled by a factor of 2 around its center of gravity. Then Pi,...,P]c cover 
T and P^ Q t+ [-1, 1]" for each i. Lemma 1X3] shows that for each i, a single call to the 2-gap CVPoq 
oracle either yields a lattice vector in f + [-1, 1]" or asserts that P/ does not contain a lattice vector. 
Since the parallelepipeds cover T, if the answers for all oracle calls are negative, we can assert that T 
does not contain a lattice vector. 

Note that the encoding size of each parallelepiped is bounded by a polynomial in n and logl/£, 
so the bound for the encoding size for each oracle call holds. □ 



3.2 Approximating the closest vector problem 

In this section we first describe a procedure to Karp-reduce the problem of computing a (1 + £)- 
approximation for CVPoo to (1 + 0(e)) -gap CVPoo. Then we combine our constructions with the BN 
algorithm to obtain the currently fastest (randomized) (1 + £) -approximation algorithm for CVPoo- 

Theorem 3.4. For every e e (0, 1) andd := min{£/5, 1/2}, given access to a [1 + 5) -gap CVPoo oracle, one 
can compute a (1 -i- e) -approximation for CVPoo M5mgO(logi»-i-logn -)-logl/£) calls to the oracle. 



We are given as input a lattice A = A(A) and target vector t. Let us assume that the distance d(_t,A) 
of a closest vector to the target vector is between 1 and at most 2'^" for some constant c> 0. This 
can be achieved by scaling, see IBN09I . We then perform a simple binary search in the following way: 

1. Set5:=min{£/5,l/2} 

2. Initialize L ^ and [/ ^ logy^s^""^ '' ■ 

3. While [/ - L > 3, do a binary search step: 

(a) Solve the (1 + (5)-gap problem with input [A, t, (1 + 5)L+m-L)l2])_ 

(b) If a lattice vector v is returned, update U ^ \log^^g \\ v - f ||oo] . 

(c) Otherwise, update 1^1+ f([/-L)/21 - 1. 

4. Solve the (1 -i- (5)-gap problem with input (A, f, (1 + 6) ^'^^) and return the resulting lattice vector. 

We first prove the correctness of this procedure before we analyze its running time. 
Lemma 3.5. The algorithm from above has the following properties. 

1. The binary search routine maintains the invariant that (_l + 5)^ < dit,A) < [1 + 6)^ . 

2. The algorithm returns a lattice vector V that satisfies \\ v - ?|loo^ (_! + E)dit,A). 

Proof. 1. The initial choices of L and U are appropriate after scaling the lattice as mentioned in 
the beginning of this section. In the case 3(b), the existence of the lattice vector v proves that the 
invariant is maintained by the update ofU. In the case 3(c), that is, when the (l-i-(5)-gap problem 
does not return a lattice vector, this implies by definition that d[t,A] > (_! + 5)i+r(c^-i)/2l-i ^j^^j 
so the invariant is maintained. 
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2. In the end, we know that d{t,A] < (1 + 5)^, so the final application of the (1 + 5)-gap problem is 
guaranteed to find a lattice vector v. This lattice vector satisfies 

\\v-t\\ < (l + (5)^+^ < a + 5f^^ <{l + 5fd{t,A) < {l + 55)d{t,A) < {l + £)d{t,A). 

For the second inequality, we used the fact that f7 - L is an integer and therefore U- L<2. □ 

Proof of Theorem \3^ Correctness of the procedure has already been shown in Lemma [331 It remains 
to bound the number of oracle calls. Let Mj be the difference U - L after the 7-th search step. By the 
initial choices of L and U we have 



Mo = 



log(l + 5) 



< c'n'^b/d 



for some constant c' > 0. Let us analyze what happens in step j. In the case 3(b), we know that 
II i; - r lloo < (1 + 5) ^LHU-L)i2] Denoting the updated value of UhyU', this implies U' < L+\{U - L)/2], 
and so < \[U-L)/2] <Mj-i/2 + l. 
In the case 3(c), we get 

Mj = U-{L+ \{U-L)/2] - 1) = Mj-i - \Mj-i/2] + 1 < Mj_i/2+ 1. 

We get the same upper bound in both cases and can conclude using induction that 

11 

< 2"-'Mo + 1 + - + - + • • • < 2"^Mo + 2. 

This implies that the number of steps is bounded by [logMol because the iteration stops when Mj 
drops below 3. From this we can derive the desired upper bound for the number of oracle calls. □ 

We now prove the main theorem by using the BN algorithm as a 2-approximation and applying 
the boosting technique for gap CVP combined with the binary search procedure. As their algorithm is 
randomized, one has to take care of the success probabilities. Their algorithm has a failure probability 
of 2""'"'. Considering the amount of oracle queries we have to issue and the requirement that every 
call has to be successful, that failure probability is too high, so we boost the success probability using 
standard techniques. 

Proof of Theorem \3J\ The BN algorithm has a success probability of at least 1 - 2"^" for some con- 
stant c> and a running time of (2 + f')^'"' • fo*^'!' when used as a (1 + e') -approximation algorithm. 

Set a:= d • [(1 + max{loglogl/£, 1} + -^logfo)] for an appropriate constant c' > that will be de- 
termined later. Let BN+ be an algorithm that runs BN as a 2-approximation algorithm a times on the 
same input and returns the closest vector that was found among all runs. This aggregated algorithm 
is a 2-approximation algorithm with a running time of max{loglog[^] , 1} • 2°'"' ■ fo*^'^' and success 
probability at least 

1 - 2-^"^" > 1 - 2-''''' (logl/e)"'''" • h-''' . 

Using the boosting technique from Theorem [321 we can construct a (1 + 5) -gap algorithm with 5 := 
min{e/ 5,1/2}, using BN+ as a 2-gap oracle. This amounts to a running time of 2^^'"' • [log Xle) • fo^'i' 
for the (1 + (5) -gap algorithm. Plugging this as a black-box into the binary search procedure, we get 
a (1 + £)- approximation algorithm by Theorem l3.4l Moreover, the number of calls to the (1 + 5)-gap 
algorithm is bounded by 0{logn+log£»+logl/e). Thus in total we get the desired running time bound 
of 

20("'(logl/£)°f"'fo°f" 



9 



which is also an upper bound to the number of calls to BN+. The probability for failure of the (1 + £)- 
approximation algorithm is bounded by the probability that one of the runs of BN+ fails. By choosing 
c' large enough, we get an upper bound of 2""*"' for the failure probability from the union bound. 

We remark that, although the encoding size for some of the instances we query the oracle for may 
exceed b, it always stays within poly{n,logpfo), so the asymptotic running time indicated above is 
not affected. □ 
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